Mini Shai-Hulud: Bun index.js in actions-cool context correlated with secret/network activity

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•0

Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.